Connect with us

Hi, what are you looking for?

Technology

Here are the new Emotet spam campaigns hitting mailboxes worldwide


Emotet

The Emotet malware kicked into action yesterday after a ten-month hiatus with multiple spam campaigns delivering malicious documents to mailboxes worldwide.

Emotet is a malware infection that is distributed through spam campaigns with malicious attachments. If a user opens the attachment, malicious macros or JavaScript will download the Emotet DLL and load it into memory using PowerShell.

Once loaded, the malware will search for and steal emails to use in future spam campaigns and drop additional payloads such as TrickBot or Qbot that commonly lead to ransomware infections.

Emotet spamming begins again

Last night, cybersecurity researcher Brad Duncan published a SANS Handler Diary on how the Emotet botnet had begun spamming multiple email campaigns to infect devices with the Emotet malware.

According to Duncan, the spam campaigns use replay-chain emails to lure the recipient into opening attached malicious Word, Excel, and password-protected ZIP files.

Reply-chain phishing emails are when previously stolen email threads are used with spoofed replies to distribute malware to other users.

In the samples shared by Duncan, we can see Emotet using reply-chains related to a “missing wallet,” a CyberMonday sale, canceled meetings, political donation drives, and the termination of dental insurance.

Advertisement. Scroll to continue reading.

Attached to these emails are Excel or Word documents with malicious macros or a password-protected ZIP file attachment containing a malicious Word document, with examples shown below.

Emotet email with Excel attachment
Emotet email with Excel attachment
Source: Brad Duncan
Emotet email with Word document attachment
Emotet email with Word document attachment
Source: Brad Duncan
Emotet email with a password-protected ZIP file
Emotet email with a password-protected ZIP file
Source: Brad Duncan

There are currently two different malicious documents being distributed in the new Emotet spam campaigns.

The first is an Excel document template that states that the document will only work on desktops or laptops and that the user needs to click on ‘Enable Content’ to view the contents properly.

Malicious Microsoft Excel attachment
Malicious Microsoft Excel attachment
Source: Brad Duncan

The malicious Word attachment is using the ‘Red Dawn‘ template and says that as the document is in “Protected” mode, users must enable content and editing to view it properly.

Microsoft Word Red Dawn attachment
Microsoft Word Red Dawn attachment
Source: Brad Duncan

How Emotet attachments infect devices

When you open Emotet attachments, the document template will state that previewing is not available and that you need to click on ‘Enable Editing’ and ‘Enable Content’ to view the content properly.

However, once you click on these buttons, malicious macros will be enabled that launch a PowerShell command to download the Emotet loader DLL from a compromised WordPress site and save it to the C:ProgramData folder.

PowerShell command to download and run the Emotet DLL
PowerShell command to download and run the Emotet DLL
Source: BleepingComputer

Once downloaded, the DLL will be launched using C:WindowsSysWo64rundll32.exe, which will copy the DLL to a random folder under %LocalAppData% and then reruns the DLL from that folder.

Folder containing renamed Emotet DLL
Folder containing renamed Emotet DLL
Source: BleepingComputer

After some time, Emotet will configure a startup value under the HKCUSoftwareMicrosoftWindowsCurrentVersionRun to launch the malware when Windows starts.

Registry Run entry used to load Emotet on startup
Registry Run entry used to load Emotet on startup
Source: BleepingComputer

The Emotet malware will now silently remain running in the background while waiting for commands to execute from its command and control server.

These commands could be to search for email to steal, spread to other computers, or install additional payloads, such as the TrickBot or Qbot trojans.

Emotet attack flow
Emotet attack flow
Source: Brad Duncan

At this time, BleepingComputer has not seen any additional payloads dropped by Emotet, which has also been confirmed by Duncan’s tests.

“I have only seen spambot activity from my recent Emotet-infected hosts,” Duncan told BleepingComputer. “I think Emotet is just getting re-established this week.”

“Maybe we’ll see some additional malware payloads in the coming weeks,” the researcher added.

Defending against Emotet

Malware and botnet monitoring org Abuse.ch has released a list of 245 command and control servers that perimeter firewalls can block to prevent communication with command and control servers.

Blocking communication to C2s will also prevent Emotet from dropping further payloads on compromised devices.

An international law enforcement operation took down the Emotet botnet in January 2021, and for ten months, the malware has not been active.

Advertisement. Scroll to continue reading.

However, starting Sunday night, active TrickBot infections began dropping the Emotet loader on already infected devices, rebuilding the botnet for spamming activity.

The return of Emotet is a significant event that all network admins, security professionals, and Windows admins must monitor for new developments.

In the past, Emotet was considered the most widely distributed malware and has a good chance of regaining its previous ranking.



Source link

Click to comment

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Advertisement

Latest

Technology

The Emotet malware kicked into action yesterday after a ten-month hiatus with multiple spam campaigns delivering malicious documents to mailboxes worldwide. Emotet is a...

Top Stories

The New York Digital Investment Group will be paying the National Basketball Association’s Houston Rockets franchise in Bitcoin as part of a partnership aimed...

Top Stories

Ether (ETH) traders might have a few reasons to panic after today’s 13% drop down to $4,100. The swift pullback appears to have broken...

Online Business Success

— AFP/File With a fresh increase of 0.23%, the Pakistani rupee settles at Rs174.89 against the US dollar in the inter-bank market. Adnan Agar...

Top Stories

Polygon, a layer two scaling solution for Ethereum compatible blockchains, stated in a press release provided to Cointelegraph that it has launched its zk-STARK...

Social Media

This should excite those looking forward to an all-immersive metaverse experience, while also likely cooling expectations around when that next level experience will become...

Top Stories

The United States Department of Justice is planning to sell $56 million worth of cryptocurrency seized in connection with its case against Ponzi scheme...

Technology

Smart tech AirPods (3rd Gen) Best voice optimization Belkin SOUNDFORM Freedom Apple’s third-generation AirPods now offers all of the innovative features that come with...

Advertisement

You May Also Like

Blogging

In this post, I will discuss the top ten profitable blogging niches ideas for Adsense approval and high traffic. whether you use Blogger or...

SEO Guide

Want to rank in Google image search? Images that you use as a featured images when writing a post actually appear on Google Images...

SEO Guide

How to index website on Google? Do you want to drive more organic traffic to your new website? I am sure your answer is...

SEO Guide

There are all kinds of pictures of the world on the internet, but to find one of these specific pictures that you want to...

Advertisement